{"record":{"id":"2d7d2ecc4cf884fa","repo":"paperclipai/paperclip","slug":"action-origin-invalid","errorCode":"action_origin_invalid","errorMessage":"Tool action request is not an agent-origin action","messagePattern":"Tool action request is not an agent-origin action","errorType":"http","errorClass":"ToolGatewayHttpError","httpStatus":409,"severity":"error","filePath":"server/src/services/tool-gateway.ts","lineNumber":4292,"sourceCode":"            // This call site owns a caller-set budget that can exceed the\n            // transport's default response deadline, so hand it down rather than\n            // letting the tighter default cut a legitimately slow tool short.\n            responseTimeoutMs: ms,\n          });\n      let requestHeaders = headers;\n      if (connection.config.mcpSessionRequired === true) {\n        requestHeaders = await initializeMcpHttpSession({\n          send: (init) => dispatchRemote(endpoint, {\n            ...init,\n            redirect: \"manual\",\n            signal: controller.signal,\n          }),\n          headers,\n          requestId,\n        });\n      }\n      // The guard runs inside this call and the connection is pinned to the\n      // address it approved, so an operator-supplied hostname cannot be rebound\n      // onto a loopback or metadata address between validation and dispatch\n      // (PAP-17098).\n      const requestInit: RequestInit = {\n        method: \"POST\",\n        redirect: \"manual\",\n        // MCP Streamable HTTP requires the Accept header advertising both a JSON\n        // body and an SSE stream; spec-compliant servers 406 without it.\n        headers: mcpHttpRequestHeaders(requestHeaders),\n        signal: controller.signal,\n        body: JSON.stringify({\n          jsonrpc: \"2.0\",\n          id: requestId,\n          method: \"tools/call\",\n          params: {\n            name: entry.toolName,\n            arguments: parameters,\n          },\n        }),","sourceCodeStart":4274,"sourceCodeEnd":4310,"githubUrl":"https://github.com/paperclipai/paperclip/blob/01ad8584922b5d85292b1723cae71fa0d9b07a19/server/src/services/tool-gateway.ts#L4274-L4310","documentation":"Guard in executeApprovedAgentInvocation: the claimed tool_action_request was not created by the agent-session path (missing agent-origin metadata), so executing it on the agent's behalf would break provenance. The 409 rejects the execution; the action must go through its intended resolution path instead.","triggerScenarios":"Thrown at server/src/services/tool-gateway.ts:4151 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Only agent-origin tool actions can be executed through this path; board-origin requests follow a different flow."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ad8584922b5d85292b1723cae71fa0d9b07a19","analyzedAt":"2026-08-18T22:49:45.177Z","contentChangedAt":"2026-08-18T22:49:45.177Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}